[dependabot]

Bumps Factory-AI/droid-action from 7 to 9.

Release notes

Sourced from Factory-AI/droid-action's releases.

v9

What's Changed

Review presets follow Factory's recommended models

• review_depth presets now use model tier aliases instead of pinned model IDs, so reviews move to newer models automatically without a new action release (#144)
  • Leaving review_model empty (recommended) uses Factory's recommended review model with high reasoning, currently GPT-6 Sol
  • review_model accepts tier aliases such as openai-latest-premium or anthropic-latest-balanced to pick a provider while still upgrading automatically; all 9 aliases are listed in the README under "Advanced: model overrides"
  • Specific model IDs still work in review_model / security_model, but pin the review to that model
  • The CLI enforces org model policy on the model an alias resolves to, and skips candidates the policy blocks
• README, GitLab guide, workflow template, and input descriptions now steer to review_depth and move model overrides to an advanced section (#144)

Works on older Droid CLIs

• If the installed CLI predates tier aliases, the action uses the equivalent concrete model with no note or error (#147)
  • GitHub: an Invalid model rejection of an alias reruns immediately with the stand-in, in the same attempt
  • GitLab: prepare probes the alias before the review passes and swaps in the stand-in before the org policy pre-flight; the probe runs without GitLab tokens
• Model blocked by organization policy from the CLI now triggers the existing fallback to the org's default model, and fallback notes name the model the workflow requested (#144, #147)

Full Changelog: Factory-AI/droid-action@v8...v9

v8

What's Changed

Review sessions carry a structured tag

• Every review pass now sends --tag with metadata instead of a bare code-review name (#142)
  • {name:"code-review", metadata:{pass, reviewType, platform, repo, pr, runId, runAttempt}} on GitHub and GitLab, for both the candidates and validator passes
  • The tag name is unchanged, so existing code-review filters keep working; the metadata lets analytics identify and pair review sessions without parsing prompt text (GitLab MR !N and dotted repo names were previously misclassified)

No retries after a usage-limit failure

• droid exec stops after the first attempt when the API returns a usage limit (#141)
  • 5-hour/weekly/monthly limits, exhausted Extra Usage, credit limit, and BYOK empty-balance 402s no longer trigger the three-attempt retry, which was opening three failed sessions per review
  • The PR comment now shows the limit's human-readable detail as the error message

Review posting

• Review posting is deterministic and pinned to the validated commit; the validator token is dropped (#138)
• Tracking and inline comments are tagged with their run type (default, unresolved, security), so comments from skipped security runs are no longer posted and combined markers survive edits (#133, @​factory-andrew-seo)
• Bot-authored reviews are allowed in CI (#137)
• GraphQL responses without an envelope no longer crash the PR fetcher (#132)

Maintenance

• Updated default review models (#135)
• Resolved dependency vulnerabilities flagged by the security scan, including the MCP SDK in the mcp-test fixture (#128, #130)

Full Changelog: Factory-AI/droid-action@v7...v8

Commits

• efd4574 Merge pull request #148 from Factory-AI/dev
• 812429d Merge pull request #147 from Factory-AI/nizar/model-fallback-note-wording
• e810e35 fix(review): policy-check tier alias stand-ins and name the requested model
• 50d2761 fix(gitlab): keep GitLab tokens out of the tier alias probe
• c7d1465 fix(review): fall back to concrete models when the CLI predates tier aliases
• 8c62c8b fix(review): blame the CLI, not the workflow, for unrecognized tier aliases
• ec0253a Merge pull request #144 from Factory-AI/nizar/model-tier-aliases
• b6a860d docs: explain that deep is Factory's hand-picked review model
• 65761de docs: steer model selection to review_depth presets
• c45caae feat(review): default review presets to model tier aliases
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #81.